Add server.request.body.filenames AppSec address for Akka HTTP#11173
Open
Add server.request.body.filenames AppSec address for Akka HTTP#11173
Conversation
jandro996
added
type: enhancement
Member
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89592b09a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 62 metrics, 9 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.062 s) : 0, 1061876
Total [baseline] (11.008 s) : 0, 11007537
Agent [candidate] (1.059 s) : 0, 1058851
Total [candidate] (11.121 s) : 0, 11120917
section appsec
Agent [baseline] (1.261 s) : 0, 1260835
Total [baseline] (11.042 s) : 0, 11042060
Agent [candidate] (1.268 s) : 0, 1268089
Total [candidate] (11.059 s) : 0, 11059098
section iast
Agent [baseline] (1.232 s) : 0, 1231870
Total [baseline] (11.261 s) : 0, 11261084
Agent [candidate] (1.248 s) : 0, 1247654
Total [candidate] (11.37 s) : 0, 11369711
section profiling
Agent [baseline] (1.186 s) : 0, 1186464
Total [baseline] (11.12 s) : 0, 11119811
Agent [candidate] (1.189 s) : 0, 1188988
Total [candidate] (11.083 s) : 0, 11083410
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.218 ms) : 0, 1218
crashtracking [candidate] (1.218 ms) : 0, 1218
BytebuddyAgent [baseline] (632.71 ms) : 0, 632710
BytebuddyAgent [candidate] (632.713 ms) : 0, 632713
AgentMeter [baseline] (29.608 ms) : 0, 29608
AgentMeter [candidate] (29.547 ms) : 0, 29547
GlobalTracer [baseline] (249.452 ms) : 0, 249452
GlobalTracer [candidate] (249.689 ms) : 0, 249689
AppSec [baseline] (32.468 ms) : 0, 32468
AppSec [candidate] (32.464 ms) : 0, 32464
Debugger [baseline] (59.971 ms) : 0, 59971
Debugger [candidate] (59.996 ms) : 0, 59996
Remote Config [baseline] (605.357 µs) : 0, 605
Remote Config [candidate] (595.434 µs) : 0, 595
Telemetry [baseline] (8.049 ms) : 0, 8049
Telemetry [candidate] (8.035 ms) : 0, 8035
Flare Poller [baseline] (11.552 ms) : 0, 11552
Flare Poller [candidate] (8.435 ms) : 0, 8435
section appsec
crashtracking [baseline] (1.218 ms) : 0, 1218
crashtracking [candidate] (1.226 ms) : 0, 1226
BytebuddyAgent [baseline] (674.26 ms) : 0, 674260
BytebuddyAgent [candidate] (679.473 ms) : 0, 679473
AgentMeter [baseline] (12.155 ms) : 0, 12155
AgentMeter [candidate] (12.237 ms) : 0, 12237
GlobalTracer [baseline] (248.868 ms) : 0, 248868
GlobalTracer [candidate] (250.439 ms) : 0, 250439
AppSec [baseline] (185.216 ms) : 0, 185216
AppSec [candidate] (186.175 ms) : 0, 186175
Debugger [baseline] (66.669 ms) : 0, 66669
Debugger [candidate] (65.572 ms) : 0, 65572
Remote Config [baseline] (572.178 µs) : 0, 572
Remote Config [candidate] (564.156 µs) : 0, 564
Telemetry [baseline] (7.851 ms) : 0, 7851
Telemetry [candidate] (7.932 ms) : 0, 7932
Flare Poller [baseline] (3.42 ms) : 0, 3420
Flare Poller [candidate] (3.504 ms) : 0, 3504
IAST [baseline] (24.233 ms) : 0, 24233
IAST [candidate] (24.4 ms) : 0, 24400
section iast
crashtracking [baseline] (1.214 ms) : 0, 1214
crashtracking [candidate] (1.231 ms) : 0, 1231
BytebuddyAgent [baseline] (808.651 ms) : 0, 808651
BytebuddyAgent [candidate] (822.087 ms) : 0, 822087
AgentMeter [baseline] (11.432 ms) : 0, 11432
AgentMeter [candidate] (11.596 ms) : 0, 11596
GlobalTracer [baseline] (239.35 ms) : 0, 239350
GlobalTracer [candidate] (240.921 ms) : 0, 240921
AppSec [baseline] (28.68 ms) : 0, 28680
AppSec [candidate] (28.392 ms) : 0, 28392
Debugger [baseline] (66.546 ms) : 0, 66546
Debugger [candidate] (64.947 ms) : 0, 64947
Remote Config [baseline] (542.402 µs) : 0, 542
Remote Config [candidate] (597.765 µs) : 0, 598
Telemetry [baseline] (7.849 ms) : 0, 7849
Telemetry [candidate] (7.79 ms) : 0, 7790
Flare Poller [baseline] (3.434 ms) : 0, 3434
Flare Poller [candidate] (3.407 ms) : 0, 3407
IAST [baseline] (28.118 ms) : 0, 28118
IAST [candidate] (30.25 ms) : 0, 30250
section profiling
ProfilingAgent [baseline] (94.248 ms) : 0, 94248
ProfilingAgent [candidate] (93.974 ms) : 0, 93974
crashtracking [baseline] (1.186 ms) : 0, 1186
crashtracking [candidate] (1.189 ms) : 0, 1189
BytebuddyAgent [baseline] (691.905 ms) : 0, 691905
BytebuddyAgent [candidate] (693.43 ms) : 0, 693430
AgentMeter [baseline] (8.983 ms) : 0, 8983
AgentMeter [candidate] (9.017 ms) : 0, 9017
GlobalTracer [baseline] (208.383 ms) : 0, 208383
GlobalTracer [candidate] (209.055 ms) : 0, 209055
AppSec [baseline] (32.507 ms) : 0, 32507
AppSec [candidate] (32.861 ms) : 0, 32861
Debugger [baseline] (65.985 ms) : 0, 65985
Debugger [candidate] (65.877 ms) : 0, 65877
Remote Config [baseline] (574.347 µs) : 0, 574
Remote Config [candidate] (567.643 µs) : 0, 568
Telemetry [baseline] (7.844 ms) : 0, 7844
Telemetry [candidate] (7.821 ms) : 0, 7821
Flare Poller [baseline] (3.496 ms) : 0, 3496
Flare Poller [candidate] (3.512 ms) : 0, 3512
Profiling [baseline] (94.805 ms) : 0, 94805
Profiling [candidate] (94.544 ms) : 0, 94544
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.062 s) : 0, 1061752
Total [baseline] (8.844 s) : 0, 8844375
Agent [candidate] (1.061 s) : 0, 1060922
Total [candidate] (8.864 s) : 0, 8864303
section iast
Agent [baseline] (1.231 s) : 0, 1231395
Total [baseline] (9.538 s) : 0, 9537626
Agent [candidate] (1.232 s) : 0, 1231890
Total [candidate] (9.6 s) : 0, 9600375
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.249 ms) : 0, 1249
crashtracking [candidate] (1.225 ms) : 0, 1225
BytebuddyAgent [baseline] (636.981 ms) : 0, 636981
BytebuddyAgent [candidate] (634.031 ms) : 0, 634031
AgentMeter [baseline] (29.764 ms) : 0, 29764
AgentMeter [candidate] (29.561 ms) : 0, 29561
GlobalTracer [baseline] (248.9 ms) : 0, 248900
GlobalTracer [candidate] (249.139 ms) : 0, 249139
AppSec [baseline] (32.302 ms) : 0, 32302
AppSec [candidate] (32.483 ms) : 0, 32483
Debugger [baseline] (58.874 ms) : 0, 58874
Debugger [candidate] (58.973 ms) : 0, 58973
Remote Config [baseline] (595.642 µs) : 0, 596
Remote Config [candidate] (584.527 µs) : 0, 585
Telemetry [baseline] (7.948 ms) : 0, 7948
Telemetry [candidate] (8.033 ms) : 0, 8033
Flare Poller [baseline] (8.986 ms) : 0, 8986
Flare Poller [candidate] (10.577 ms) : 0, 10577
section iast
crashtracking [baseline] (1.244 ms) : 0, 1244
crashtracking [candidate] (1.219 ms) : 0, 1219
BytebuddyAgent [baseline] (809.018 ms) : 0, 809018
BytebuddyAgent [candidate] (810.695 ms) : 0, 810695
AgentMeter [baseline] (11.409 ms) : 0, 11409
AgentMeter [candidate] (11.391 ms) : 0, 11391
GlobalTracer [baseline] (239.158 ms) : 0, 239158
GlobalTracer [candidate] (238.481 ms) : 0, 238481
AppSec [baseline] (25.571 ms) : 0, 25571
AppSec [candidate] (27.56 ms) : 0, 27560
Debugger [baseline] (65.267 ms) : 0, 65267
Debugger [candidate] (65.745 ms) : 0, 65745
Remote Config [baseline] (535.388 µs) : 0, 535
Remote Config [candidate] (528.171 µs) : 0, 528
Telemetry [baseline] (7.735 ms) : 0, 7735
Telemetry [candidate] (7.806 ms) : 0, 7806
Flare Poller [baseline] (3.459 ms) : 0, 3459
Flare Poller [candidate] (3.403 ms) : 0, 3403
IAST [baseline] (31.837 ms) : 0, 31837
IAST [candidate] (28.251 ms) : 0, 28251
LoadParameters
See matching parameters
SummaryFound 5 performance improvements and 2 performance regressions! Performance is the same for 14 metrics, 15 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section baseline
no_agent (19.035 ms) : 18843, 19228
. : milestone, 19035,
appsec (19.649 ms) : 19450, 19848
. : milestone, 19649,
code_origins (18.858 ms) : 18668, 19048
. : milestone, 18858,
iast (17.686 ms) : 17510, 17862
. : milestone, 17686,
profiling (18.367 ms) : 18184, 18550
. : milestone, 18367,
tracing (17.712 ms) : 17536, 17888
. : milestone, 17712,
section candidate
no_agent (17.147 ms) : 16976, 17319
. : milestone, 17147,
appsec (18.479 ms) : 18290, 18668
. : milestone, 18479,
code_origins (17.762 ms) : 17589, 17935
. : milestone, 17762,
iast (17.9 ms) : 17720, 18080
. : milestone, 17900,
profiling (18.218 ms) : 18036, 18401
. : milestone, 18218,
tracing (18.594 ms) : 18404, 18783
. : milestone, 18594,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section baseline
no_agent (1.269 ms) : 1256, 1282
. : milestone, 1269,
iast (3.296 ms) : 3249, 3343
. : milestone, 3296,
iast_FULL (5.971 ms) : 5911, 6030
. : milestone, 5971,
iast_GLOBAL (3.505 ms) : 3450, 3561
. : milestone, 3505,
profiling (2.059 ms) : 2041, 2077
. : milestone, 2059,
tracing (1.832 ms) : 1817, 1846
. : milestone, 1832,
section candidate
no_agent (1.239 ms) : 1227, 1252
. : milestone, 1239,
iast (3.221 ms) : 3175, 3266
. : milestone, 3221,
iast_FULL (5.835 ms) : 5776, 5894
. : milestone, 5835,
iast_GLOBAL (3.588 ms) : 3529, 3646
. : milestone, 3588,
profiling (2.434 ms) : 2409, 2459
. : milestone, 2434,
tracing (1.866 ms) : 1849, 1883
. : milestone, 1866,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 2 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section baseline
no_agent (1.494 ms) : 1483, 1506
. : milestone, 1494,
appsec (3.784 ms) : 3564, 4003
. : milestone, 3784,
iast (2.289 ms) : 2218, 2360
. : milestone, 2289,
iast_GLOBAL (2.338 ms) : 2267, 2409
. : milestone, 2338,
profiling (2.118 ms) : 2062, 2174
. : milestone, 2118,
tracing (2.094 ms) : 2040, 2148
. : milestone, 2094,
section candidate
no_agent (1.49 ms) : 1478, 1502
. : milestone, 1490,
appsec (3.772 ms) : 3553, 3991
. : milestone, 3772,
iast (2.304 ms) : 2233, 2375
. : milestone, 2304,
iast_GLOBAL (2.343 ms) : 2272, 2415
. : milestone, 2343,
profiling (2.542 ms) : 2328, 2756
. : milestone, 2542,
tracing (2.095 ms) : 2040, 2149
. : milestone, 2095,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~f3cd8924cc, baseline=1.62.0-SNAPSHOT~8569434beb
dateFormat X
axisFormat %s
section baseline
no_agent (15.68 s) : 15680000, 15680000
. : milestone, 15680000,
appsec (14.643 s) : 14643000, 14643000
. : milestone, 14643000,
iast (18.497 s) : 18497000, 18497000
. : milestone, 18497000,
iast_GLOBAL (18.313 s) : 18313000, 18313000
. : milestone, 18313000,
profiling (14.917 s) : 14917000, 14917000
. : milestone, 14917000,
tracing (14.619 s) : 14619000, 14619000
. : milestone, 14619000,
section candidate
no_agent (15.543 s) : 15543000, 15543000
. : milestone, 15543000,
appsec (14.777 s) : 14777000, 14777000
. : milestone, 14777000,
iast (18.197 s) : 18197000, 18197000
. : milestone, 18197000,
iast_GLOBAL (18.142 s) : 18142000, 18142000
. : milestone, 18142000,
profiling (15.005 s) : 15005000, 15005000
. : milestone, 15005000,
tracing (15.179 s) : 15179000, 15179000
. : milestone, 15179000,
|
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61873-6-akka
branch
from
77765ec to
3ee4e5e
Compare
jandro996
changed the title
jandro996
requested review from
claponcet,
daniel-romano-DD and
manuel-alvarez-alvarez
jandro996
changed the title
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61873-6-akka
branch
from
3ee4e5e to
2848d37
Compare
Member
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2848d3738a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61873-6-akka
branch
from
2848d37 to
8daa014
Compare
Member
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Akka HTTP 10.0 / 10.6
UnmarshallerHelpers.handleMultipartStrictFormData(): extracts filenames fromMultipart.FormData.BodyPart.StrictviagetFilename()and fires therequestFilesFilenamesIG callback. BothrequestBodyProcessedandrequestFilesFilenamesare fetched upfront; the early return only triggers when both are null. Blocking is supported viaAkkaBlockResponseFunction.setUnmarshallBlock(true).UnmarshallerHelpers.handleStrictFormData(): adds the same filename extraction for theformFieldMultiMappath, which goes throughStrictFormCompanionInstrumentationand was not previously reachinghandleMultipartStrictFormData.Spring Boot
testBodyFilenames()enabled inSpringBootBasedTest(Spring Boot defaults to Tomcat, whoseParsePartsInstrumentationalready firesrequestFilesFilenames).Motivation
Implements the
server.request.body.filenamesWAF address for Akka HTTP.Jira ticket: APPSEC-61873
Additional Notes
requestBodyProcessedandrequestFilesFilenamesare registered as independent callbacks inGatewayBridge.DATA_DEPENDENCIES— a deployment with filename-only WAF rules will haverequestBodyProcessed == nullbutrequestFilesFilenames != null. Returning early when only one is null would silently skip filename detection in that case.Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueNote: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.